SaaS (The Cloud): Functional Restriction
In a Business Central SaaS environment, Microsoft manages the infrastructure. The logic here is: "You have access to everything technically, but you are restricted functionally."
-
Automatic Object Access: When you install an extension or when Microsoft pushes a global update, those new objects (tables, pages, reports) are automatically included in your environment.
-
The Entitlement Filter: Even though the objects are "there," your license (Entitlement) acts as a filter. If an object is outside your license scope, you can't open it directly.
However, you might still be able to interact with it indirectly
through an approved action.
-
The Admin Benefit: You don't have to manually update a license file every time you add a new app from AppSource. The system handles the technical "plumbing."
On-Premises: Technical Restriction
In an on-premises environment, the logic is reversed: "You have access to nothing unless it is explicitly granted."
-
Manual License Updates: By default, your license file contains a specific range of objects you are allowed to access. If you install a new extension that introduces new objects, those objects remain "invisible" or "locked" until you manually update your license file to include them.
-
Hard Blocks: If an object isn't in your license, the system won't even let the code execute. This is a technical barrier rather than a functional one.
-
The Admin Burden: Administrators must be much more proactive. Every software update or new module requires a corresponding license check to ensure the technical rights are in place before users can even try to log in.
Why Does This Distinction Matter?
Whether you are in the cloud or on your own servers, these differences impact your daily operations in three ways:
-
Troubleshooting: If a user gets an error in SaaS, it’s usually a functional permission set issue. In On-Prem, it might be that the object isn't in the license at all.
-
Upgrades: SaaS updates are seamless regarding permissions. On-Prem upgrades require careful coordination between the software version
and the license file.
-
Third-Party Apps: When testing a new solution, SaaS users can "plug and play." On-Prem users need to ensure their partner has updated their license to "see" the new app's objects.
One Constant: The Permission Set
Despite these differences at the license level, both environments still rely
on Permission Sets to define what a user can do. Whether the door is unlocked by an Entitlement (SaaS) or a License File (On-Prem), you still need to decide who gets a key to which room.
Our solutions like the Authorization Box are designed to bridge this gap, providing a consistent management experience regardless of where your Business Central environment lives.
Moving from On-Prem to SaaS and worried about your permission structure? Check out our "Is your Dynamics application fraud proof?" checklist to ensure your transition is secure.
